CVE-2022-3383CWE-94

Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select

High · published November 29, 2022

CVSS v3.1
7.2
EPSS
3%
Percentile
87.4
In the wild
Unconfirmed
What it is

The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03047 · 87.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2022-11-29T20:40Z
EPSS history
Timeline
  • 29 NOV 20:40Z
    Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select
    cvelistv5